From a024bd336dfdeb654da01635f15048d9dbc76b32 Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Thu, 28 Mar 2013 16:29:52 +0000 Subject: [PATCH] adjust the find_aslr_shift and mac_proc_maps plugins for proper widths of long/unsigned long values --- volatility/plugins/mac/find_aslr_shift.py | 2 +- volatility/plugins/mac/proc_maps.py | 5 ++--- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/volatility/plugins/mac/find_aslr_shift.py b/volatility/plugins/mac/find_aslr_shift.py index eeb9a98b..c5717f05 100644 --- a/volatility/plugins/mac/find_aslr_shift.py +++ b/volatility/plugins/mac/find_aslr_shift.py @@ -33,7 +33,7 @@ class mac_find_aslr_shift(common.AbstractMacCommand): yield self.profile.shift_address def render_text(self, outfd, data): - self.table_header(outfd, [("DTB Value", "[addr]")]) + self.table_header(outfd, [("DTB Value", "#018x")]) for shift_address in data: if shift_address == 0: debug.error("Shift addresses are only required on 10.8+ images") diff --git a/volatility/plugins/mac/proc_maps.py b/volatility/plugins/mac/proc_maps.py index 3298cd1a..3188fb68 100644 --- a/volatility/plugins/mac/proc_maps.py +++ b/volatility/plugins/mac/proc_maps.py @@ -42,12 +42,11 @@ class mac_proc_maps(pslist.mac_pslist): map = map.links.next def render_text(self, outfd, data): - self.table_header(outfd, [("Start", "[addrpad]"), - ("End", "[addrpad]"), + self.table_header(outfd, [("Start", "#018x"), + ("End", "#018x"), ("Perms", "9"), ("Map Name", "")]) - ## FIXME: [addrpad] gets truncated here for some reason for (proc, map) in data: self.table_row(outfd, map.links.start,